Information and help with Windows svchost.exe

What is the svchost.exe file?

The term SvcHost, also known as svchost.exe or Service Host, is a process used to host one or more operating system services. The svchost.exe Microsoft Windows executable file is labeled as: Generic Host Process for Win32 Services. This is a required Windows file and is used to load needed DLL files that are used with Microsoft Windows and Windows programs that run on your computer.

This file is located in either the c:\windows\system32 or c:\winnt\system32 directories depending on your version of Windows and may also be located in the dllcache directory if present.

Why do I have multiple svchost.exe processes running in Task Manager?

The operating system may run multiple instances of the SvcHost process, depending on how many services need to run. Each service that is run inside the SvcHost process is sharing the process, which helps to reduce the amount of resources (RAM) used up on the computer. It is common to see three or four svchost.exe in the Task Manager Processes tab.

While this shared process can help reduce resource use on the computer, it can also have a few drawbacks. If any one of the services running inside the SvcHost process generates an unhandled exception error, it causes the whole process to shut down. Subsequently this can cause additional errors to occur due to the services no longer running inside that shared process. Also, because svchost.exe is a common process in the Task Manager, malware programs sometimes mask themselves by running under the same process name of svchost.exe. Other times, a malware program may run, or inject, its service into an already running svchost.exe process. In either case, this masking action can make it difficult to detect and remove these malware programs.

Is svchost.exe a virus or trojan?

There are viruses that can infect this file and may run as an SVCHOST.EXE service. If you think your computer is infected with a computer virus, we recommend you update your virus protection program and visit the Microsoft Windows update page.

If your antivirus protection software does not detect a virus or other malware, your computer is not infected and the svchost.exe file is not a virus.

SVCHOST.EXE error with 0xe03c3a68 or computer crashes with this file when opening Microsoft Internet Explorer.

Users experiencing an error with the above memory address are infected with the blaster virus.

How can I remove svchost.exe?

This file is an important Windows file and needed by Windows. Removing this file would cause Windows to no longer function. If this file is infected with a virus, your antivirus program should be able to quarantine or delete the file.

How can I view what applications svchost is handling?

To determine what are in the svchost.exe file you need either tlist.exe if you are running Windows 2000 or tasklist.exe if you are running Windows XP. Windows users can also view what is running under svchost through Windows Defender.

Running the tlist and tasklist program

Windows XP users can run this program by clicking Start, Run, and type command or cmd and press enter. From the MS-DOS prompt, type tasklist /svc and press enter.

Windows 2000 users can run this program by clicking Start, Run, and type command or cmd and press enter. From the MS-DOS prompt, type tlist -s and press enter.

* If you are unable to run or locate this file on the computer, see steps below on installing this file onto your computer.

Windows XP Professional users that are unable to locate this file can expand it from the i386 directory on their Windows XP Professional CD or download the file from the above link. Unfortunately, the Windows XP Home CD does not contain this file.

Tlist Windows 2000 Installation

If you do not have this file you need to install the Microsoft Windows 2000 support tools. To do this, place the Windows 2000 CD into the computer and run setup.exe from \SUPPORT\TOOLS directory.

Example of what is seen in tlist and tasklist

Below is an example of how the Windows XP output of tasklist may appear.

Image Name

PID

Session Name

Session#

Mem Usage

===============

======

==========

========

=========

cmd.exe

6076

Console

0

132 K

notepad.exe

1152

Console

0

2,660 K

firefox.exe

5868

Console

0

397,008 K

SecureCRT.EXE

4288

Console

0

10,968 K

thunderbird.exe

1812

Console

0

54,572 K

notepad.exe

532

Console

0

1,584 K

perl.exe

1528

Console

0

48,936 K

Below is an example of what Windows 2000 would display for the svchost services. With tlist.exe or tasklist.exe you should see information similar to the example below.